Why Are Security Pros Blasé About Compliance?

A survey of 500 IT and security decision makers in the UK and US shows that a majority are in the dark about regulatory requirements for their business organization.

Regulatory compliance is often seen as an oppressive demand on an organization, something that must be adhered to because, well, it just has to be, rather than because it benefits the business.

For some IT and security professionals, it's tempting to view the importance of complying with regulatory rules on how to secure data as secondary to their own security measures. You know how to secure your organization's data better than a government agency, right?

The truth is that many regulation sets have very specific requirements around how data is stored and secured, making them very much a consideration for IT. In the US, the Sarbanes-Oxley Act (SOX) and Payment Card Industry Data Security Standards (PCI DSS) are a case in point.

SOX compliant? Not sure… A recent IS Decisions survey of 500 IT decision makers in the UK and US sheds some light on the fact that a majority of IT professionals are in the dark about whether there even are regulatory requirements for their organization. A full 57% of respondents in the US "don't know" whether they are compliant with SOX or not.

SOX, as you probably know, applies to public companies and as such is designed to ensure the accuracy of financial data and combat fraudulent activity. It is quite specific about addressing one of the greatest security challenges, particularly for large organizations: insider threats.

Most US organizations are not publicly listed, so perhaps IT teams can be excused for not being sure about their SOX compliance. But firstly, SOX must be considered -- this is federal law. Though it doesn't apply if your business is not publicly listed, some awareness of its implications can't hurt.

Moreover, the sheer number of internal security breaches occurring in US businesses every day -- our research told us the number is more than 2,500 -- indicates that businesses of every size and financial status could benefit from being aware of these regulations and how they can protect sensitive data.

PCI: widely applicable, broadly ignored On the other hand, PCI DSS applies to a far greater majority of businesses. The international regulatory standard around the storing, processing, and protection of credit card information applies to all businesses that take card payments, which is most businesses. Yet two-thirds of IT professionals are not sure if they are compliant or not, according to our research.

Despite the fact that the breach-stricken Target appears to have been approved as PCI compliant by the security firm Trustwave, a lawsuit filed against the two organizations claimed that the retailer was not entirely adherent to regulations. Though Target passed compliance testing in September 2012, according to the complaint, the auditors did notice some warning signs at the time, including a lack of network segmentation between card data and the rest of the corporate network. This suggests that, even though Target passed muster, compliance may easily have dropped off in the time before the breach occurred.

Though the lawsuit has now been dropped, the revelations and the fact that the huge breach of cardholder data occurred indicates that PCI compliance is not just a regulatory burden. It's not even a business "must." It's a minimum requirement. Further, it is not a requirement that must be met when the auditors are around; it must be an always-adhered-to standard. Yet two-thirds of IT professionals told us they don't even know if they're meeting those requirements.

Technology is just part of the solution Like many of the aspects of tackling internal security, achieving compliance with regulations like SOX and PCI can seem insurmountable. Internal security and the related issue of insider threats has to be approached from a cultural perspective, with fundamental changes made to user education and attitudes.

We have seen that the results of failing to meet regulatory standards in examples like the Target case, and we know that the internal security breaches that these regulations are designed to combat are occurring on an astoundingly regular basis. What will it take for security teams to show less indifference toward compliance? Let's chat about that in the comments.

François Amigorena is founder and CEO of IS Decisions, a provider of infrastructure and security management software solutions for Microsoft Windows and Active Directory. IS Decisions offers solutions for user access control, file auditing, server and desktop ... View Full Bio